@shared-runtime/modules

{"modified":"2026-09-18T20:25:02Z","published":"2026-09-18T20:25:02Z","schema_version":"1.7.4","id":"MAL-2026-16291","summary":"Malicious code in @shared-runtime/modules (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bc6095cf4766c948193c22d8c0e775010fc3ab47733a1020fb8fd5367d88e5e9)\n@shared-runtime/modules@9.9.10 collects the installer's OS username (os.userInfo().username), hostname (os.hostname()) and current working-directory basename, then issues a dns.resolve4() query against a subdomain assembled as srmods.<user>.<host>.<cwd>.<ts>.oob.algamil7x.xyz, leaking those values via authoritative DNS logs at the attacker-controlled domain oob.algamil7x.xyz. The destination hostname, the OS/DNS API names, and the module names are stored as hex byte arrays in lib/a74d1f.js and lib/f63c0e.js and reconstructed at runtime via String.fromCharCode, with os and dns loaded through module.constructor._load to avoid literal require() strings. Execution is triggered both at install (package.json scripts.install=\"node index.js\") and on require() (index.js top-level require('./lib/core.js')), with a swallowed try/catch so npm install still reports success. The README claims no hidden network calls in module scope while module scope performs exactly that.\n","affected":[{"package":{"ecosystem":"npm","name":"@shared-runtime/modules"},"versions":["9.9.10"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/core.js","sha256":"4070258a961f709343b8e24e65b570daee851b33aa3b48dd5c38ebc58bbcbf19","tlsh":"57f02d69b393c48fa7e096d0361a53d18859c3c0e7cf4195fb7c4a87904e7d1cb85959"},{"path":"lib/f63c0e.js","sha256":"f7942b52b33a05f44ce43c1cc581fa1140cbbef03acdba961ade9f4a44cb03e1","tlsh":"73f0595166a3d19f77d69ac35f4190a0acb60a40b60ed0d5fa2c1bde00eeb13e9c54b0"},{"path":"package.json","sha256":"42bd797ba1aa9f714c91816c77fe1082406ebc2de3bf76c3cae318268c39603a","tlsh":"8b018e321d7668371ec477d3f9a2148577a248db4410a8495a9f423842ce53371ff33e"}],"package_integrity":[{"filename":"modules-9.9.10.tgz","hashes":{"sha1":"d398cfdd6dfb6c7e9bb917c9ecfbc05d4746bd97","sha512_sri":"sha512-fpgjU+mj24R9GJLUQjKSBocGKp6ZZL9LJ/rP7LPZffxdAdQGTKA8THNVjWcduCJ7EOVyayXifyc8kNU+9wvIBA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@shared-runtime/modules/v/9.9.10"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020187","import_time":"2026-09-18T20:38:13.751622937Z","modified_time":"2026-09-18T20:25:02Z","sha256":"bc6095cf4766c948193c22d8c0e775010fc3ab47733a1020fb8fd5367d88e5e9","source":"amazon-inspector","versions":["9.9.10"]}]}}